Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\110410-17643-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a19000 PsLoadedModuleList = 0xfffff800`02c56e50
Debug session time: Thu Nov 4 04:23:07.556 2010 (UTC - 4:00)
System Uptime: 0 days 0:21:51.992
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 1097, 0, fffff880066e2d80}
GetPointerFromAddress: unable to read from fffff80002cc10e0
GetUlongFromAddress: unable to read from fffff80002c2f1b0
GetUlongFromAddress: unable to read from fffff80002c2f1b0
Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+5cde )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001097, (reserved)
Arg3: 0000000000000000, Memory contents of the pool block
Arg4: fffff880066e2d80, Address of the block of pool being deallocated
Debugging Details:
------------------
GetUlongFromAddress: unable to read from fffff80002c2f1b0
GetUlongFromAddress: unable to read from fffff80002c2f1b0
POOL_ADDRESS: fffff880066e2d80
BUGCHECK_STR: 0xc2_7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002bbc60e to fffff80002a8af00
STACK_TEXT:
fffff880`066e2bc8 fffff800`02bbc60e : 00000000`000000c2 00000000`00000007 00000000`00001097 00000000`00000000 : nt!KeBugCheckEx
fffff880`066e2bd0 fffff880`0123c247 : fffff880`066e2cd0 00000000`00000000 fffff8a0`0197db00 fffffa80`00000000 : nt!ExFreePool+0xccb
fffff880`066e2c80 fffff880`0122aa12 : fffff880`066e3040 fffffa80`0793ec10 fffffa80`04c9f180 fffff8a0`0197db10 : Ntfs! ?? ::FNODOBFM::`string'+0x5cde
fffff880`066e2e50 fffff880`0122f413 : fffff880`066e3040 fffffa80`0793ec10 fffff880`066e3200 fffff880`066e3901 : Ntfs!NtfsCommonWrite+0x872
fffff880`066e3010 fffff880`00c3823f : fffffa80`0793efb0 fffffa80`0793ec10 fffffa80`0746dbb0 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`066e3290 fffff880`00c366df : fffffa80`061a03b0 fffffa80`05351910 fffffa80`061a0300 fffffa80`0793ec10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`066e3320 fffff800`02a79b4f : fffffa80`0793ec10 fffff880`066e3838 fffff880`066e3530 fffff880`009e9180 : fltmgr!FltpDispatch+0xcf
fffff880`066e3380 fffff800`02a791c7 : 00000000`00000000 fffff880`066e3838 fffffa80`0175b5a0 00000000`00000000 : nt!IoSynchronousPageWrite+0x24f
fffff880`066e3400 fffff800`02a77194 : fffff8a0`01a05200 fffff8a0`01a05210 fffffa80`07067190 fffffa80`07067190 : nt!MiFlushSectionInternal+0xa58
fffff880`066e3640 fffff800`02a76a99 : fffffa80`0705ccd8 00000000`00000000 00000000`00002000 00000000`00000000 : nt!MmFlushSection+0x1f4
fffff880`066e3700 fffff880`012e3642 : fffffa80`0705ccd8 fffff880`00000000 fffffa80`00000000 00000000`00002000 : nt!CcFlushCache+0x5e9
fffff880`066e3800 fffff880`012e46ba : fffff8a0`0197db10 fffff8a0`0197db10 fffff8a0`0197db10 fffffa80`0461c900 : Ntfs!NtfsFlushUserStream+0x92
fffff880`066e3880 fffff880`012e388e : fffffa80`0461c900 fffff8a0`0197db10 fffff880`066e3a40 fffff880`00c3927e : Ntfs!NtfsPerformOptimisticFlush+0x7a
fffff880`066e38e0 fffff880`012e45f0 : fffffa80`0461c900 fffffa80`0479a010 fffffa80`05351910 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x12a
fffff880`066e39c0 fffff880`00c3823f : fffffa80`0479a3b0 fffffa80`0479a010 fffffa80`0461c900 fffff880`066e39e8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`066e3a30 fffff880`00c366df : fffffa80`061a03b0 00000000`00000001 fffffa80`061a0300 fffffa80`0479a010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`066e3ac0 fffff800`02d9e929 : 00000000`00000002 fffffa80`05351910 00000000`00000001 fffffa80`0479a010 : fltmgr!FltpDispatch+0xcf
fffff880`066e3b20 fffff800`02d2c8ad : fffffa80`0479a010 fffffa80`070f7b60 fffffa80`05351910 fffff880`009e9180 : nt!IopSynchronousServiceTail+0xf9
fffff880`066e3b90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtFlushBuffersFile+0x171
STACK_COMMAND: kb
FOLLOWUP_IP:
Ntfs! ?? ::FNODOBFM::`string'+5cde
fffff880`0123c247 90 nop
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Ntfs! ?? ::FNODOBFM::`string'+5cde
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
FAILURE_BUCKET_ID: X64_0xc2_7_Ntfs!_??_::FNODOBFM::_string_+5cde
BUCKET_ID: X64_0xc2_7_Ntfs!_??_::FNODOBFM::_string_+5cde
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\110210-29078-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a01000 PsLoadedModuleList = 0xfffff800`02c3ee50
Debug session time: Tue Nov 2 05:28:39.302 2010 (UTC - 4:00)
System Uptime: 0 days 0:13:25.738
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {5003, fffff70001080000, df, e1000001b6}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+297b1 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 00000000000000df
Arg4: 000000e1000001b6
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_5003
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: iexplore.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002ae226c to fffff80002a72f00
STACK_TEXT:
fffff880`08646878 fffff800`02ae226c : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`000000df : nt!KeBugCheckEx
fffff880`08646880 fffff800`02a99353 : 0de00001`07f14025 00000001`07e14121 fffff8a0`00000000 fffffa80`03e1c428 : nt! ?? ::FNODOBFM::`string'+0x297b1
fffff880`08646910 fffff800`02a8ed9e : 00000000`00000000 00000000`7713d000 fffff680`003b89e8 fffffa80`03e1c428 : nt!MiResolveProtoPteFault+0x1d3
fffff880`086469b0 fffff800`02a8cf23 : 00000000`00000000 00000000`7713d000 fffff880`08646ca0 fffff800`00000000 : nt!MiDispatchFault+0x1de
fffff880`08646ac0 fffff800`02a70fee : 00000000`00000000 00000000`77584138 00000000`7efdb001 00000000`00000000 : nt!MmAccessFault+0x343
fffff880`08646c20 00000000`7759ff88 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0037f418 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7759ff88
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+297b1
fffff800`02ae226c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+297b1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+297b1
BUCKET_ID: X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+297b1
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\110410-19047-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a60000 PsLoadedModuleList = 0xfffff800`02c9de50
Debug session time: Thu Nov 4 05:18:29.587 2010 (UTC - 4:00)
System Uptime: 0 days 0:38:52.023
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000096, fffff88001034621, fffff88003782a18, fffff88003782270}
Probably caused by : hardware ( volsnap!VspCopyDataWorker+1a1 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000096, The exception code that was not handled
Arg2: fffff88001034621, The address that the exception occurred at
Arg3: fffff88003782a18, Exception Record Address
Arg4: fffff88003782270, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000096 - {
FAULTING_IP:
volsnap!VspCopyDataWorker+1a1
fffff880`01034621 6c ins byte ptr [rdi],dx
EXCEPTION_RECORD: fffff88003782a18 -- (.exr 0xfffff88003782a18)
ExceptionAddress: fffff88001034621 (volsnap!VspCopyDataWorker+0x00000000000001a1)
ExceptionCode: c0000096
ExceptionFlags: 00000000
NumberParameters: 0
CONTEXT: fffff88003782270 -- (.cxr 0xfffff88003782270)
rax=0000000000000000 rbx=0000000000004000 rcx=fffffa8004aaa1a8
rdx=0000000000000000 rsi=fffffa8004aaa190 rdi=0000000361ab8000
rip=fffff88001034621 rsp=fffff88003782c50 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000004
r11=0000000000000000 r12=fffffa8003df71b0 r13=fffffa8003e00c10
r14=0000000000000000 r15=0000000326448000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
volsnap!VspCopyDataWorker+0x1a1:
fffff880`01034621 6c ins byte ptr [rdi],dx ds:002b:00000003`61ab8000=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000096 - {
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: STATUS_PRIVILEGED_INSTRUCTION
MISALIGNED_IP:
volsnap!VspCopyDataWorker+1a1
fffff880`01034621 6c ins byte ptr [rdi],dx
LAST_CONTROL_TRANSFER: from fffff8800101493d to fffff88001034621
STACK_TEXT:
fffff880`03782c50 fffff880`0101493d : fffffa80`04a98400 00000003`61acf000 fffffa80`03df71b0 fffffa80`077c8810 : volsnap!VspCopyDataWorker+0x1a1
fffff880`03782d00 fffff800`02d75166 : fffffa80`04b70b60 00000000`00000080 fffffa80`03b6f040 fffffa80`04b70b60 : volsnap!VspWorkerThread+0xad
fffff880`03782d40 fffff800`02ab0486 : fffff800`02c4ae80 fffffa80`04b70b60 fffff800`02c58c40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03782d80 00000000`00000000 : fffff880`03783000 fffff880`0377d000 fffff880`037826a0 00000000`00000000 : nt!KxStartSystemThread+0x16
FOLLOWUP_IP:
volsnap!VspCopyDataWorker+1a1
fffff880`01034621 6c ins byte ptr [rdi],dx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: volsnap!VspCopyDataWorker+1a1
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xfffff88003782270 ; kb
MODULE_NAME: hardware
FAILURE_BUCKET_ID: X64_IP_MISALIGNED_volsnap.sys
BUCKET_ID: X64_IP_MISALIGNED_volsnap.sys
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\110410-21200-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a51000 PsLoadedModuleList = 0xfffff800`02c8ee50
Debug session time: Thu Nov 4 06:09:21.702 2010 (UTC - 4:00)
System Uptime: 0 days 0:05:13.138
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88002fb65d8, fffff88002fb5e30, fffff80002aa651a}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteScb+108 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88002fb65d8
Arg3: fffff88002fb5e30
Arg4: fffff80002aa651a
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88002fb65d8 -- (.exr 0xfffff88002fb65d8)
ExceptionAddress: fffff80002aa651a (nt!RtlDeleteNoSplay+0x0000000000000096)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000
CONTEXT: fffff88002fb5e30 -- (.cxr 0xfffff88002fb5e30)
rax=fffff8a009229280 rbx=0000000000000000 rcx=fffff8a00a9cf1f8
rdx=0000000000000000 rsi=ffffffffffffffff rdi=fffffa80060ae6e8
rip=fffff80002aa651a rsp=fffff88002fb6810 rbp=fffffa8007b42510
r8=fffffa80060ae6e8 r9=ffffffffffffffff r10=fffff880009eaa20
r11=fffff8a009229280 r12=0000000000000703 r13=0000000000000000
r14=fffffa8007b424c8 r15=fffff8a009a8fed0
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!RtlDeleteNoSplay+0x96:
fffff800`02aa651a 48890b mov qword ptr [rbx],rcx ds:002b:00000000`00000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000000
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf90e0
0000000000000000
FOLLOWUP_IP:
Ntfs!NtfsDeleteScb+108
fffff880`012c7bcc 488b03 mov rax,qword ptr [rbx]
FAULTING_IP:
nt!RtlDeleteNoSplay+96
fffff800`02aa651a 48890b mov qword ptr [rbx],rcx
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff8800103a373 to fffff80002aa651a
STACK_TEXT:
fffff880`02fb6810 fffff880`0103a373 : fffff8a0`0a841500 fffff800`02bf62dd fffffa80`06038270 ffffffff`ffffffff : nt!RtlDeleteNoSplay+0x96
fffff880`02fb6840 fffff880`01036238 : fffff8a0`09d18600 fffff800`02bf62dd fffffa80`6e664d46 fffff880`0103f66e : fltmgr!TreeUnlinkNoBalance+0x13
fffff880`02fb6870 fffff880`0105435c : 00000000`00000000 fffff880`02fb69e1 fffffa80`052f2180 fffffa80`048ddd50 : fltmgr!TreeUnlinkMulti+0x148
fffff880`02fb68c0 fffff880`01056bc1 : fffffa80`04b84800 00000000`00000130 fffff8a0`09a8fbc0 fffff8a0`09a8fbc0 : fltmgr!FltpDeleteContextList+0x3c
fffff880`02fb68f0 fffff880`01056b7b : fffffa80`04b84800 fffff8a0`09a8fed0 fffffa80`04b84800 fffff8a0`07704b00 : fltmgr!CleanupStreamListCtrl+0x21
fffff880`02fb6920 fffff800`02daf46e : 00000000`00000001 fffff880`012c81a7 fffff8a0`09a8fed0 00000000`00000000 : fltmgr!DeleteStreamListCtrlCallback+0x6b
fffff880`02fb6950 fffff880`012c7bcc : fffff8a0`09a8fbc0 fffffa80`03bceb60 fffff880`02fb6a28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`02fb69a0 fffff880`012c78d5 : 00000000`00000000 00000000`00000000 fffff800`02c66500 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`02fb69e0 fffff880`0123acb4 : fffff8a0`09a8fac0 fffff8a0`09a8fbc0 fffff800`02c66500 fffff880`02fb6b52 : Ntfs!NtfsRemoveScb+0x61
fffff880`02fb6a20 fffff880`012c52dc : fffff8a0`09a8fa90 fffff800`02c665a0 fffff880`02fb6b52 fffffa80`042aaa40 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`02fb6a50 fffff880`01243882 : fffffa80`042aaa40 fffffa80`042aaa40 fffff8a0`09a8fa90 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`02fb6ad0 fffff880`012dc813 : fffffa80`042aaa40 fffff800`02c665a0 fffff8a0`09a8fa90 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`02fb6b10 fffff880`012b638f : fffffa80`042aaa40 fffff8a0`09a8fbc0 fffff8a0`09a8fa90 fffffa80`052f2180 : Ntfs!NtfsCommonClose+0x353
fffff880`02fb6be0 fffff800`02ad0161 : 00000000`00000000 fffff880`012b6200 fffff800`02cc8101 00000442`00000003 : Ntfs!NtfsFspClose+0x15f
fffff880`02fb6cb0 fffff800`02d66166 : 00000442`00000000 fffffa80`03bceb60 00000000`00000080 fffffa80`03bba040 : nt!ExpWorkerThread+0x111
fffff880`02fb6d40 fffff800`02aa1486 : fffff880`009e9180 fffffa80`03bceb60 fffff880`009f3f40 00000442`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02fb6d80 00000000`00000000 : fffff880`02fb7000 fffff880`02fb1000 fffff880`02fb69f0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: Ntfs!NtfsDeleteScb+108
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff88002fb5e30 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteScb+108
BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteScb+108
Followup: MachineOwner
---------
1: kd> lmtn
start end module name
fffff880`00ee4000 fffff880`00f3b000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02cec000 fffff880`02d76000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04fda000 fffff880`04ff0000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`03f33000 fffff880`03f48000 amdppm amdppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`00ec0000 fffff880`00ecb000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`0489f000 fffff880`048a7000 ASACPI ASACPI.sys Wed Jul 15 23:31:29 2009 (4A5E9F11)
fffff880`00e8d000 fffff880`00e96000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e96000 fffff880`00ec0000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`042da000 fffff880`042fb000 AtiHdmi AtiHdmi.sys Wed Sep 30 09:54:46 2009 (4AC36326)
fffff880`048b1000 fffff880`04ed6000 atikmdag atikmdag.sys Wed Nov 11 00:25:32 2009 (4AFA4ACC)
fffff880`01869000 fffff880`01870000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`03e20000 fffff880`03f0d000 BHDrvx64 BHDrvx64.sys Fri Aug 27 18:11:09 2010 (4C7837FD)
fffff880`03d98000 fffff880`03da9000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`05da8000 fffff880`05dc6000 bowser bowser.sys Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff880`03cfc000 fffff880`03d98000 ccHPx64 ccHPx64.sys Fri Aug 21 19:01:40 2009 (4A8F2754)
fffff960`00780000 fffff960`007a7000 cdd cdd.dll unavailable (00000000)
fffff880`01836000 fffff880`01860000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00d33000 fffff880`00df3000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`019c7000 fffff880`019f7000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00cd5000 fffff880`00d33000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0142d000 fffff880`014a0000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`04fca000 fffff880`04fda000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`05a1a000 fffff880`05a28000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`03a0f000 fffff880`03a92000 csc csc.sys Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`03cde000 fffff880`03cfc000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`03a00000 fffff880`03a0f000 discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`019b1000 fffff880`019c7000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04338000 fffff880`0435a000 drmk drmk.sys Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`05a34000 fffff880`05a3d000 dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05a28000 fffff880`05a34000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`043b4000 fffff880`043c7000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`05a00000 fffff880`05a0c000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`04ed6000 fffff880`04fca000 dxgkrnl dxgkrnl.sys Mon Jul 13 19:38:56 2009 (4A5BC590)
fffff880`04800000 fffff880`04846000 dxgmms1 dxgmms1.sys Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`03b89000 fffff880`03bff000 eeCtrl64 eeCtrl64.sys Fri May 21 17:44:45 2010 (4BF6FECD)
fffff880`06bdb000 fffff880`06bfb000 ENG64 ENG64.SYS Wed Sep 15 06:25:35 2010 (4C909F1F)
fffff880`06a1d000 fffff880`06bdb000 EX64 EX64.SYS Wed Sep 15 06:33:41 2010 (4C90A105)
fffff880`010eb000 fffff880`010ff000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01031000 fffff880`0107d000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`014b1000 fffff880`014bb000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01977000 fffff880`019b1000 fvevol fvevol.sys Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`01874000 fffff880`018be000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`0486a000 fffff880`04877000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`02a08000 fffff800`02a51000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`04846000 fffff880`0486a000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`04200000 fffff880`04219000 HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`05a3f000 fffff880`05a47080 HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`043e4000 fffff880`043f2000 hidusb hidusb.sys Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`05ce0000 fffff880`05da8000 HTTP HTTP.sys Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`0196e000 fffff880`01977000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`03b0e000 fffff880`03b89000 IDSvia64 IDSvia64.sys Fri Sep 10 17:54:50 2010 (4C8AA92A)
fffff880`00fb8000 fffff880`00fdf000 Ironx64 Ironx64.SYS Wed Nov 25 18:04:17 2009 (4B0DB7F1)
fffff880`03c3b000 fffff880`03c4a000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04219000 fffff880`04227000 kbdhid kbdhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bc8000 fffff800`00bd2000 kdcom kdcom.dll Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`03c59000 fffff880`03c9c000 ks ks.sys Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`013d5000 fffff880`013ef000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`015ad000 fffff880`015d8000 ksecpkg ksecpkg.sys Mon Jul 13 19:50:34 2009 (4A5BC84A)
fffff880`0435a000 fffff880`0435f200 ksthunk ksthunk.sys Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`03cae000 fffff880`03cc3000 lltdio lltdio.sys Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04227000 fffff880`0424a000 luafv luafv.sys Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00cb4000 fffff880`00cc1000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`05a0c000 fffff880`05a1a000 monitor monitor.sys Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`03c4a000 fffff880`03c59000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`0424a000 fffff880`04257000 mouhid mouhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00e73000 fffff880`00e8d000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`05dc6000 fffff880`05dde000 mpsdrv mpsdrv.sys Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`05c00000 fffff880`05c2c000 mrxsmb mrxsmb.sys Mon Jul 13 19:23:59 2009 (4A5BC20F)
fffff880`05c2c000 fffff880`05c79000 mrxsmb10 mrxsmb10.sys Mon Jul 13 19:24:08 2009 (4A5BC218)
fffff880`05c79000 fffff880`05c9c000 mrxsmb20 mrxsmb20.sys Mon Jul 13 19:24:05 2009 (4A5BC215)
fffff880`01200000 fffff880`0120b000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f44000 fffff880`00f4e000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`0113a000 fffff880`01198000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`03b03000 fffff880`03b0e000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`0195c000 fffff880`0196e000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014bb000 fffff880`015ad000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04ff0000 fffff880`04ffc000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`03dcd000 fffff880`03dfc000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`042c5000 fffff880`042da000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02dea000 fffff880`02df9000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02d76000 fffff880`02dbb000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01198000 fffff880`011f8000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`0120b000 fffff880`0121c000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03af7000 fffff880`03b03000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02a51000 fffff800`0302e000 nt ntkrnlmp.exe Mon Jul 13 19:40:48 2009 (4A5BC600)
fffff880`01232000 fffff880`013d5000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`01860000 fffff880`01869000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`02dc4000 fffff880`02dea000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00f8e000 fffff880`00fa3000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00f4e000 fffff880`00f81000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00e5c000 fffff880`00e63000 pciide pciide.sys Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00e63000 fffff880`00e73000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`014a0000 fffff880`014b1000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`0601f000 fffff880`060c5000 peauth peauth.sys Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`042fb000 fffff880`04338000 portcls portcls.sys Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cc1000 fffff880`00cd5000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`03da9000 fffff880`03dcd000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03e00000 fffff880`03e1b000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`03c00000 fffff880`03c21000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`03c21000 fffff880`03c3b000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03aa6000 fffff880`03af7000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`03ff0000 fffff880`03ffb000 rdpbus rdpbus.sys Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`019f7000 fffff880`01a00000 RDPCDD RDPCDD.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`015f6000 fffff880`015ff000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`013ef000 fffff880`013f8000 rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01922000 fffff880`0195c000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`03cc3000 fffff880`03cdb000 rspndr rspndr.sys Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`03f9e000 fffff880`03ff0000 Rt64win7 Rt64win7.sys Mon Feb 08 22:42:09 2010 (4B70D991)
fffff880`060c5000 fffff880`060d0000 secdrv secdrv.SYS Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`04893000 fffff880`0489f000 serenum serenum.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`02c00000 fffff880`02c1d000 serial serial.sys Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`0191a000 fffff880`01922000 spldr spldr.sys Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`06589000 fffff880`065fa000 spsys spsys.sys Mon May 11 13:20:58 2009 (4A085E7A)
fffff880`06503000 fffff880`06589000 SRTSP64 SRTSP64.SYS Wed Dec 02 00:55:48 2009 (4B160164)
fffff880`00fdf000 fffff880`00ff3000 SRTSPX64 SRTSPX64.SYS Wed Dec 02 00:58:24 2009 (4B160200)
fffff880`0646b000 fffff880`06503000 srv srv.sys Mon Jul 13 19:25:11 2009 (4A5BC257)
fffff880`0610f000 fffff880`06178000 srv2 srv2.sys Mon Jul 13 19:25:02 2009 (4A5BC24E)
fffff880`060d0000 fffff880`060fd000 srvnet srvnet.sys Mon Jul 13 19:24:58 2009 (4A5BC24A)
fffff880`04ffc000 fffff880`04ffd480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`0107d000 fffff880`010eb000 SYMDS64 SYMDS64.SYS Mon Aug 17 19:35:30 2009 (4A89E942)
fffff880`010ff000 fffff880`0113a000 SYMEFA64 SYMEFA64.SYS Mon Nov 23 20:35:40 2009 (4B0B386C)
fffff880`02cb6000 fffff880`02cec000 SYMEVENT64x86 SYMEVENT64x86.SYS Thu Aug 13 18:28:21 2009 (4A849385)
fffff880`02c40000 fffff880`02cb6000 SYMTDIV SYMTDIV.SYS Thu Nov 19 21:21:24 2009 (4B05FD24)
fffff880`01602000 fffff880`017ff000 tcpip tcpip.sys Mon Jul 13 19:25:34 2009 (4A5BC26E)
fffff880`060fd000 fffff880`0610f000 tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`0121c000 fffff880`01229000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`01000000 fffff880`0101e000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`00ecb000 fffff880`00edf000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00500000 fffff960`0050a000 TSDDD TSDDD.dll unavailable (00000000)
fffff880`03f0d000 fffff880`03f33000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`04360000 fffff880`043b4000 udfs udfs.sys Mon Jul 13 19:23:37 2009 (4A5BC1F9)
fffff880`03c9c000 fffff880`03cae000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`043c7000 fffff880`043e4000 usbccgp usbccgp.sys Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`05a3d000 fffff880`05a3ef00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04882000 fffff880`04893000 usbehci usbehci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`0426b000 fffff880`042c5000 usbhub usbhub.sys Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`04877000 fffff880`04882000 usbohci usbohci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`03f48000 fffff880`03f9e000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`00f81000 fffff880`00f8e000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`015d8000 fffff880`015e6000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`05a4b000 fffff880`05bfc000 viahduaa viahduaa.sys Tue Mar 02 06:30:18 2010 (4B8CF6CA)
fffff880`01400000 fffff880`01425000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`018be000 fffff880`018ce000 vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00fa3000 fffff880`00fb8000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e00000 fffff880`00e5c000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`018ce000 fffff880`0191a000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02c1d000 fffff880`02c38000 wanarp wanarp.sys Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`015e6000 fffff880`015f6000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00c00000 fffff880`00ca4000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ca4000 fffff880`00cb3000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02dbb000 fffff880`02dc4000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000d0000 fffff960`003df000 win32k win32k.sys unavailable (00000000)
fffff880`048a7000 fffff880`048b0000 wmiacpi wmiacpi.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00f3b000 fffff880`00f44000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117)
Unloaded modules:
fffff880`01800000 fffff880`0180e000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880`0180e000 fffff880`0181a000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff880`0181a000 fffff880`01823000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
fffff880`01823000 fffff880`01836000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000
Quote